Re: [logs] RE: syslog/tcp (selp)

From: Kyle R. Hofmann (krhat_private)
Date: Thu Jan 09 2003 - 15:22:13 PST

  • Next message: Bennett Todd: "[logs] Trial SELP client implementation"

    On Thu, 09 Jan 2003 10:47:12 +0100, "Rainer Gerhards" wrote:
    > > * we should not discuss character sets, we should only state
    > > that the MSG
    > >   part is transmitted 8bit clean
    > Agree. But this still prohibits DBCS, as byte values below 0x20 can
    > occur, especially CRLF. This probably confuses collectors not expecting
    > this. We could solve this with byte-counting, but I am not sure if we go
    > overboard. After all, it should be a very slight addition to
    > syslog/udp...
    OK, I have a simple solution.  The header will have three fields instead of
    two.  The first will be the length, the second time, and the third host.  The
    length will count every octet the occurs in the header, the message, and the
    With this, we lose no more backwards compatibility than we already have; a
    classic syslog daemon will already insert its own timestamp in front of our
    RFC 3339 one, and a new syslog daemon will know how to read the length.
    This changes if we want to allow old-style timestamps, however, I think an
    RFC3339 timestamp should be a MUST for the new format.  Implementations SHOULD
    be capable of converting new-style messages to old and transmitting old-style
    messages to other hosts on a host-by-host basis.
    Kyle R. Hofmann <krhat_private>
    LogAnalysis mailing list

    This archive was generated by hypermail 2b30 : Thu Jan 09 2003 - 15:39:38 PST